Closed rpoet-jh closed 9 months ago
Looks good. I was wondering about pass-data-client, but CORS should not apply to those requests because they won't have an origin header set.
Right, the deposit/notification services and data loaders that use pass-data-client actually communicate directly with pass-core:8080 bypassing the proxy/auth containers. CORS enforcement is mainly a function of the browser, so this seem ok.
The
Access-Control-Allow-Origin
header was set to*
allowing any domain to make a CORS request. I have changed this so that theAccess-Control-Allow-Origin
will be set tohttps://domainname
.I also removed the access control headers since allowing the browser to default is recommended. Additionally, I didn't see any requests where a header named
authorization
was being returned, so theAccess-Control-Expose-Headers
appeared to be not relevant to PASS.I tested these changes locally and on stage, and logging into pass worked fine.